Subimage (YC W25) | Founding Engineer | San Francisco, CA | ONSITE (5 days/week) | Full-time | $170K–$230K + 0.5%–1.0% equity | https://subimage.io
Hihi, I'm Alex, co-founder and CEO. Subimage maps infrastructure the way an attacker does so security teams at scale-ups and enterprises can find and fix problems. We're built on Cartography (https://cartography.dev), the open source infra mapping tool we helped create at Lyft and donated to the CNCF. It runs at over 70 companies, including 7 in the Fortune 100.
We're a tiny seed-stage team and our customers are companies your parents have heard of. We have more demand than we can build for, which is why this post exists. This is a chance to get in on the ground floor of something big (or to find out quickly that it won't work; just being upfront about it).
Some of the problems you'd be working on:
- Vulnerability triage with real context: is the asset internet-facing, through which services, is the vulnerable function actually reachable in code, are there compensating controls, and what sensitive data does it reach once exploited, across how many hops.
- Proving that the security fixes our agent proposes won't break anything.
- A near-real-time, self-updating map of an environment so you can see an attack as it happens, plus "time travel" in the graph so you can replay it afterward.
- Teaching an agent to answer questions about a large graph quickly, with only the context it needs and without making mistakes.
- Determining who owns a given resource from messy signals like tags, actions, logs, and files.
Stack: Cartography for ingestion, Neo4j for the graph, Python/FastAPI backend, Svelte frontend with a homegrown WebGL graph renderer, an MCP server that exposes all of it to agents, Terraform for IaC.
Who we're looking for: 3+ years at high-growth companies, strong distributed systems and cloud experience, a real sense of ownership, first-principles thinking, and a willingness to implement gnarly business logic (elegantly, ideally) if it makes a jaded security engineer's life easier. Kubernetes and security knowledge are nice to have, not required. You're in the Bay Area and want to be in the office five days a week.
Process: technical screen, call with the founders, a paid day working with the team, then offer. Health/vision/dental, 401k match, gym, team lunches, unlimited PTO.
Apply here and mention HN: https://www.ycombinator.com/companies/subimage/jobs/NCTFgKK-...